CERT-AGID Reports 191 Malicious Campaigns Targeting or Affecting Italy in a Week
Summary
CERT-AGID reported 191 malicious campaigns for the week of September 12–18, including phishing impersonating Italian agencies and malware delivered through email attachments, links, and SMS. It shared 1,498 indicators of compromise with accredited entities.
Key points
- Of the 191 campaigns, 158 targeted Italian users and 33 were generic campaigns that also affected Italy.
- Phishing themes included refunds, unpaid fines, banking, and domain renewals; the report counted 46 refund-themed and 42 fine-themed campaigns.
- A fake vacation-bonus site impersonated Italy’s tax agencies and simulated authentication using SPID or CieID to steal personal data.
- Other phishing campaigns impersonated the Electronic Health Record and sought personal, tax, card, or banking details.
- CERT-AGID observed 10 malware families, including Remcos, AgentTesla, FormBook, AsyncRAT, and Grandoreiro.
- Malware delivery methods included archive and spreadsheet attachments, links to malicious scripts, and SMS links to Android APKs.
Article Details
- Event Type
- CERT-AGID reported phishing and malware campaigns affecting Italy during the week of 12–18 September.
- Impact
- CERT-AGID identified 191 malicious campaigns: 158 targeting Italy and 33 generic campaigns that also affected Italy. It made 1,498 identified indicators of compromise available to accredited entities. Reported phishing campaigns sought personal and financial information, while malware campaigns included malicious attachments, scripts, and Android APK download links.
Malware
AgentTeslaAgentTesla – Scoperte tre campagne generiche a tema ordine “Ordine” distribuite mediante allegati RAR, ZIP e 7Z.AsyncRATAsyncRat – Scoperta una campagna generica a tema “Documenti” diffusa mediante email contenente link a script JS malevolo.BingoModUsato inoltre per veicolare i malware BingoMod, RatHat e Remcos.FormBookFormBook – Individuate tre campagne generiche ad argomento “Prezzi”, “Documenti” e “Ordine”, tutte veicolate mediante archivi RAR allegati.GrandoreiroGrandoreiro – Individuata una campagna generica ad argomento “Fattura” diffusa tramite link che permettono il download di archivi ZIP.GuloaderGuloader – Osservate una campagna italiana a tema “Prezzi” diffusa con allegato XLS e due campagne generiche a tema “Ordine” e “Documenti” diffuse con allegati ZIP e 7Z.MassLoggerMassLogger – Osservata una campagna italiana a tema “Ordine” distribuita per mezzo di allegato ZIP.RatHatUsato inoltre per veicolare i malware BingoMod, RatHat e Remcos.RemcosUsato inoltre per veicolare i malware BingoMod, RatHat e Remcos.
Products
CieIDA differenza di altre campagne, questa risulta particolarmente curata: il sito fraudolento è organizzato in diverse sezioni e simula anche la procedura di autenticazione con SPID o CieID.ScreenConnectScreenConnect – Rilevate due campagne generiche a tema “Pagamenti” e “Documenti” distribuite con email o documenti PDF contenti link a script malevoli.SPIDA differenza di altre campagne, questa risulta particolarmente curata: il sito fraudolento è organizzato in diverse sezioni e simula anche la procedura di autenticazione con SPID o CieID.